Input: tsc2007 - prevent overflow in pressure calculation

The touch resistance calculation in the tsc2007 driver is prone to
overflow if (z2 - z1) is large and also x is reasonably big. This
overflow results in the driver emitting input events when very little
touch pressure is applied. In these events the x and y coordinates can
be substantially off.

Avoid the overflow by using u64 when calculating resistance value.

Signed-off-by: Johannes Kirchmair <johannes.kirchmair@skidata.com>
Link: https://lore.kernel.org/r/20250129-fix_tsc_calculation_overflow-v2-1-9e51333496ad@skidata.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

diff --git a/drivers/input/touchscreen/tsc2007_core.c b/drivers/input/touchscreen/tsc2007_core.c
index 05e00a084c88dec11b1d4758c3428811a55d46ba..948935de894bfb0c3f75327aa6ac50bf0b1e9f40 100644 (file)
--- a/drivers/input/touchscreen/tsc2007_core.c
+++ b/drivers/input/touchscreen/tsc2007_core.c
@@ -23,6 +23,7 @@
 #include <linux/input.h>
 #include <linux/interrupt.h>
 #include <linux/i2c.h>
+#include <linux/math64.h>
 #include <linux/mod_devicetable.h>
 #include <linux/property.h>
 #include <linux/platform_data/tsc2007.h>
@@ -68,7 +69,7 @@ static void tsc2007_read_values(struct tsc2007 *tsc, struct ts_event *tc)
 
 u32 tsc2007_calculate_resistance(struct tsc2007 *tsc, struct ts_event *tc)
 {
-       u32 rt = 0;
+       u64 rt = 0;
 
        /* range filtering */
        if (tc->x == MAX_12BIT)
@@ -79,11 +80,13 @@ u32 tsc2007_calculate_resistance(struct tsc2007 *tsc, struct ts_event *tc)
                rt = tc->z2 - tc->z1;
                rt *= tc->x;
                rt *= tsc->x_plate_ohms;
-               rt /= tc->z1;
+               rt = div_u64(rt, tc->z1);
                rt = (rt + 2047) >> 12;
        }
 
-       return rt;
+       if (rt > U32_MAX)
+               return U32_MAX;
+       return (u32) rt;
 }
 
 bool tsc2007_is_pen_down(struct tsc2007 *ts)